Top talkers command in ISR 4431

[sridhar ch]

Hi,

I have recently replaced my cisco 2811 with ISR 4431 and had a very tough to find out the top talkers (IP's) consuming more BW.  Though the below command gives the data, but its not sorted unlike in earlier versions. Plz help.

sh flow monitor BW cache format table

IPV4 SRC ADDR   IPV4 DST ADDR   intf input    intf output         bytes long              pkts long

Commands configured:

flow record BW
description top_talkers
match ipv4 source address
match ipv4 destination address
collect interface input
collect interface output
collect counter bytes long
collect counter packets long
flow monitor xyz1
description to monitor normal traffic
record netflow-original
flow monitor BW
description description top_talkers
record BW

Below commands are applied to WAN interface:

ip flow monitor xyz1 input
ip flow monitor BW input
ip flow monitor xyz1 output
ip flow monitor BW output

Thanks,

Sridhar

[Jose Solano]

Hi,

Top talkers option does not work the same way on FNF as on TNF, for IOS-XE using flexible netflow you need to use filters such as the following command, below is also a link that covers this.

#show flow monitor FLOW-MONITOR-1 cache sort highest counter packets

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fnetflow/configuration/15-mt/fnf-15-mt-book/cgf-topn.html#GUID-0340CBF8-EBAE-448D-B119-B345243C94C5

Hope this is helpful.

Jose

[sridhar ch]

thx, i am not getting the option "Sort highest counter packets". Plz see below.

ISR4431-01#show flow monitor BW cache ?
format Specify cache display format
| Output modifiers
<cr>

ISR4431-01#show flow monitor BW cache fo
ISR4431-01#show flow monitor BW cache format ?
csv Flow monitor cache contents in csv format
record Flow monitor cache contents in record format
table Flow monitor cache contents in table format

[Jose Solano]

Hi,

The device must be running 03.16.02.S / 15.5(3)S2 or above if you would like to make use of the Netflow FNFv9 Top Talkers commands.

Regards,

Jose

[anthonnyfr2009]

Hi Jose, thanks for your support. I have one question. In the mib of netflow can i see the sames values?

[j.a.m.e.s]

All,

Even on v16.9.05 on the ISR4431 there is still no sort highest counter packets or aggregate commands. It looks like the same deal on the ASR1k platform.

Router#show flow monitor FM-TOPTALKERS cache ?
  format  Specify cache display format
  |       Output modifiers
  <cr>    <cr>

Does anyone have an IOS-XE version with FNF top-talker support for either ISR or ASR1k platforms?

Regards

James.

[dmorin003]

Strange, on 16.6.4 I do have cache sort option.   What I am disappointed though is not having aggregate.

#show flow monitor ipv4_flow_monitor cache sort ?
counter Counter fields
flow Flow identifying fields
highest Sort from highest to lowest
interface Interface fields
ipv4 IPv4 fields
lowest Sort from lowest to highest
routing Routing attributes
timestamp Timestamp fields
transport Transport layer fields